Accelerate playbook development using the Agentic Playbook Builder (preview)

Use the Agentic Playbook Builder (preview) in Cortex XSIAM to create, optimize, and troubleshoot playbooks using natural language and security best practices.

The Agentic Playbook Builder leverages the Automation Engineer agent to enable security teams to create, optimize, and troubleshoot playbooks using natural language and security best practices.

Note

During the private preview phase, consumed Compute Units for the Agentic Playbook Builder are free, they will not be charged against your license usage.

Agentic Playbook Builder capabilities in Cortex XSIAM

• Creating new playbooks Generate functional, structured playbooks from a natural language prompt. During this preview phase, the builder automatically selects the best options from your installed integrations and follows security best practices to optimize performance. It does this by using its built-in knowledge of the platform's automation framework, including the required SDK and your existing playbooks. (Full access to the Marketplace catalog will be introduced at GA). Example: “Create a playbook that is triggered by a new network alert containing an IP address. First, run standard IP enrichment and threat intelligence lookups to triage the IP and check for associated malware. Next, add a conditional task to evaluate if the IP is marked as malicious. If it is malicious, send an email to [e-mail]. If benign, close the incident.”

• Maintaining and optimizing existing playbooks Modify existing tasks, logic, triggers, or integrations using conversational follow-ups. By dynamically learning tenant environment details, active instances, and custom automations, the builder redefines existing playbooks to continuously fix bugs and improve execution efficiency while scanning available automations to highlight potential design flaws. Example:

  • “Add error handling to this flow”

  • “In the 'Is Malicious' condition, change the target email address to [e-mail].”

• Learning and extracting information (querying and explaining) Ask questions in the prompt to understand complex workflow logic, break down custom scripts, or troubleshoot specific tasks. The builder allows analysts to query the platform and extract real-time data across any playbook, integration, or platform automation capability, including details from out-of-the-box system playbooks. Example:

  • "Explain the logic behind the conditional branch in this playbook."

  • "How do I use the AgentiX SDK to add a custom header to the outgoing email task in this workflow?"

Note

The Automation Engineer agent is available with the Cortex Agentic Assistant, for users with playbook view/edit permissions and Interact with agent enabled.

For more information, see Agentic Assistant role-based access control.

Use the Agentic Playbook Builder in Cortex XSIAM

1. Navigate to Investigation & Response → Automation → Playbooks.

2. Create a new playbook or open an existing one to enter the Playbook Editor.

3. Click the Agentic Assistant icon. The Agentic Assistant pane opens with the Automation Engineer agent automatically selected.

4. In the chat interface, enter a natural language prompt describing the automation you want to build or the change you want to make. The agent automatically uses the active playbook as context. Any request to create, modify, or query details applies specifically to that playbook. Example:

   • "Build a playbook that is triggered by a phishing alert, extracts the sender's domain, and checks its reputation using VirusTotal. If malicious, block the domain in Okta and notify the security team via Slack."

   • “Create a playbook that is triggered by a new network alert containing an IP address. First, run standard IP enrichment and threat intelligence lookups to triage the IP and check for associated malware. Next, add a conditional task to evaluate if the IP is marked as malicious. If it is malicious, use the mail integration to send an email to [e-mail] containing the IP address, the alert details, and the associated malware context. If it is benign, close the incident.”

5. Click the submit arrow or press Enter to submit the prompt. The Agentic Assistant then displays:

   • The plan describing the steps taken, including retrieving relevant integrations and generating playbook logic.

   • A playbook preview card showing playbook metadata, task counts, revision numbers, and visual expansion options.

6. Refine the logic interactively by providing additional conversational instructions. You can for example provide additional instructions such as "Add a 10-minute delay before the Slack notification". If the agent cannot find a specific command or script for a task, it creates a placeholder task in the editor for you to complete manually.

7. Click Use this revision to push the AI-generated logic to the Playbook Editor. Revisions can only be applied while in Edit Mode. If you have unsaved manual changes, the system prompts you to confirm before overwriting them.

Track AI-assisted Cortex XSIAM playbook development

To help maintain visibility into which automations were created or modified by AI:

• Any playbook generated or significantly modified by the agent is automatically assigned the AI Assisted tag.

• The Agentic Assistant maintains a history of your conversation and revisions, allowing you to compare versions or revert to an earlier state.

Agentic Playbook Builder best practices

You do not need a perfect prompt on the first try. Use iterative feedback to fine-tune your playbook.

• Automation best practices The builder guides creation using Cortex XSIAM security best practices to ensure optimal performance and error prevention.

• Best match automation The builder analyzes thousands of marketplace components to ensure the best fit for your task.

Example:

• "Add error handling for the VirusTotal task."

• "Change the notification channel from Slack to Microsoft Teams."

• "Ensure the playbook only triggers if the severity is High."

Known limitations

During the private preview phase, keep the following temporary performance guidelines and feature constraints in mind to ensure an effective evaluation of the Agentic Playbook Builder.

• Playbook generation and edit speeds Generating or modifying playbooks takes approximately 3 minutes for small playbooks, 5 minutes for medium playbooks, and 8 minutes for large playbooks.

• Marketplace scope The agent currently accesses installed content only. Full access to Marketplace will be introduced at General Availability (GA).

• Interactive clarification Guided workflows to help refine incomplete prompts will be added at GA.

• SOP / SOW file ingestion Direct file upload for Statements of Work (SOW) and automation guidelines will be available at GA.

• Compute Unit metrics Usage tracking metrics for Compute Units will be available in upcoming releases.

• Knowledge customization Adding custom files links to agents is not available for the private preview phase.